|
2 | 2 |
|
3 | 3 | ## Introduction
|
4 | 4 |
|
5 |
| -By design this project only defines dependencies in one place, i.e. in the `requires` table in `pyproject.toml`. |
| 5 | +Since the move to `uv`, this project natively supports a lockfile. This is a set of "known good" dependencies that the tests are run against, and will be used to create a container if one is built. |
6 | 6 |
|
7 |
| -In the `requires` table it is possible to pin versions of some dependencies as needed. For library projects it is best to leave pinning to a minimum so that your library can be used by the widest range of applications. |
| 7 | +## Specifying dependencies |
8 | 8 |
|
9 |
| -When CI builds the project it will use the latest compatible set of dependencies available (after applying your pins and any dependencies' pins). |
| 9 | +The source of dependencies is the project's `pyproject.toml`. They can come from: |
| 10 | +- Project dependencies (from `[project]` `dependencies =`) |
| 11 | +- Dev dependencies (from `[dependency-groups]` `dev =`) |
| 12 | +- Transitive dependencies (child dependencies of the above) |
10 | 13 |
|
11 |
| -This approach means that there is a possibility that a future build may break because an updated release of a dependency has made a breaking change. |
12 |
| - |
13 |
| -The correct way to fix such an issue is to work out the minimum pinning in `requires` that will resolve the problem. However this can be quite hard to do and may be time consuming when simply trying to release a minor update. |
14 |
| - |
15 |
| -For this reason we provide a mechanism for locking all dependencies to the same version as a previous successful release. This is a quick fix that should guarantee a successful CI build. |
16 |
| - |
17 |
| -## Finding the lock files |
18 |
| - |
19 |
| -Every release of the project will have a set of requirements files published as release assets. |
20 |
| - |
21 |
| -For example take a look at the release page for python-copier-template [here](https://github.com/DiamondLightSource/python-copier-template/releases/tag/1.1.0) |
22 |
| - |
23 |
| -There is a single `dev-requirements.txt` file showing as an asset on the release. This has been created using `pip freeze --exclude-editable` on a successful test run using the same version of python as the devcontainer, and will contain a full list of the dependencies and sub-dependencies with pinned versions. You can download this file by clicking on it. |
24 |
| - |
25 |
| -## Applying the lock file |
26 |
| - |
27 |
| -To apply a lockfile: |
28 |
| - |
29 |
| -- copy the requirements file you have downloaded to the root of your repository |
30 |
| -- commit it into the repo |
31 |
| -- push the changes |
32 |
| - |
33 |
| -The CI looks for a `dev-requirements.txt` in the root and will pass it to pip as a constraint when installing the dev environment. If a package is required to be installed by `pyproject.toml` then `pip` will use the version specified in `dev-requirements.txt`. |
| 14 | +Dependencies are loosely specified in `pyproject.toml`, like `sphinx-autobuild` or `pydata-sphinx-theme>=0.12`. They should state a minimum version if you are using features that are added in a specific version. There should be no upper bound by default, only insert one if an upstream release of a dependency breaks your code, and you don't have time to fix it immediately. |
34 | 15 |
|
35 | 16 | ## Updating the lockfile
|
36 | 17 |
|
37 |
| -1. Open the repo in a devcontainer |
38 |
| -1. Delete dev-requirements.txt |
39 |
| -1. Restart your dev container |
40 |
| -1. Check the tests run |
41 |
| -1. Then run `pip freeze --exclude-editable > dev-requirements.txt` |
42 |
| -1. Check the new file into Git |
43 |
| -1. Push and merge the changes |
| 18 | +When you have updated `pyproject.toml` then run: |
| 19 | +``` |
| 20 | +$ uv sync |
| 21 | +``` |
| 22 | + |
| 23 | +This will ensure that any new dependencies you add will be placed in the lockfile, and your venv updated to match. It will *not* update any existing dependencies, unless `pyproject.toml` requires a later version. |
44 | 24 |
|
45 |
| -## Removing dependency locking from CI |
| 25 | +This command will be run by [pre-commit](./lint) during a `git commit` and by CI. |
46 | 26 |
|
47 |
| -Once the reasons for locking the build have been resolved it is a good idea to go back to an unlocked build. This is because you get an early indication of any incoming problems. |
| 27 | +To update all dependencies to their latest versions run: |
| 28 | +``` |
| 29 | +uv sync --upgrade |
| 30 | +``` |
48 | 31 |
|
49 |
| -To restore unlocked builds in CI simply remove `dev-requirements.txt` from the root of the repo and push. |
| 32 | +```{seealso} |
| 33 | +[The uv docs on locking and syncing](https://docs.astral.sh/uv/concepts/projects/sync) |
| 34 | +``` |
0 commit comments